{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contact-form-by-supsystic--1.11.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supsystic:contact_form:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-115301"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contact Form by Supsystic (\u003c 1.11.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Supsystic"],"content_html":"\u003cp\u003eThe Contact Form by Supsystic WordPress plugin versions prior to 1.11.1 contain a vulnerability where the template engine used for rendering forms is not properly sandboxed. This flaw allows an authenticated administrator to inject arbitrary template code into form-editor content. When a visitor subsequently views a page containing the affected form, the injected template is compiled and executed by the server. This permits arbitrary code execution and the unauthorized disclosure of sensitive server-side information, such as authentication salts and database credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Furthermore, the vulnerability impacts unauthenticated visitors, as the stored payload is executed during page rendering, leading to potential exfiltration of environment-specific secrets like database credentials and authentication salts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Contact Form by Supsystic WordPress plugin to version 1.11.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit administrative user access within the WordPress dashboard to identify accounts with form-editing permissions that may have been leveraged for this exploit.\u003c/li\u003e\n\u003cli\u003ePerform a post-patch review of server configuration files, including 'wp-config.php', for unauthorized modifications or access attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:19:26Z","date_published":"2026-10-29T13:19:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-contact-form-supsystic-ssti/","summary":"The Contact Form by Supsystic WordPress plugin before 1.11.1 allows authenticated users to perform server-side template injection via unsandboxed form templates, leading to remote code execution and unauthorized access to sensitive server configuration files.","title":"Contact Form by Supsystic: Server-Side Template Injection (CVE-2026-115301)","url":"https://feed.craftedsignal.io/briefs/2026-10-contact-form-supsystic-ssti/"}],"language":"en","title":"CraftedSignal Threat Feed - Contact Form by Supsystic (\u003c 1.11.1)","version":"https://jsonfeed.org/version/1.1"}